An SME that uses a conversational assistant, a voice agent or a CV screening tool is a deployer under the European regulation on artificial intelligence. That status decides almost everything. Most of the heavy obligations in the EU AI Act target providers, the companies that design systems and place them on the market. For a deployer, the list is short, and the most concrete item has applied since August 2026.
Tandem supports more than 50 companies on AI deployment, and the question comes up in every management meeting. Here is what an SME actually has to do, in order. The timeline in force after the July 2026 omnibus, the inventory of use cases, the risk classification, transparency duties, AI literacy, fines, and who enforces the rules in France.
Deployer or provider, the status that drives your obligations
The EU AI Act separates two roles. A provider develops an AI system and places it on the market under its own name. A deployer uses that system under its own authority, as part of its professional activity. An SME that buys a subscription, plugs an agent into its website or rolls out a copilot in its tools is a deployer, and nothing else.
The distinction has an immediate practical effect. Technical documentation, conformity assessment, CE marking and system risk management all sit with the provider. Your employees using the tool under your instructions are not separate deployers, and bringing in a contractor on your behalf does not move your responsibility.
The EU AI Act timeline after the July 2026 omnibus
The regulation has applied in waves since February 2025. A corrective text adopted in July 2026, the digital omnibus on AI, pushed back the heaviest deadlines without touching the rest. France's CNIL updated its timeline in August 2026 to reflect it, and that is the one that holds today.
| Deadline | What applies | Does it concern an SME |
|---|---|---|
| February 2025 | Prohibited practices and AI literacy | Yes |
| August 2025 | Rules on general-purpose AI models | No, unless you train a model |
| August 2026 | Transparency obligations | Yes, this is the date that matters |
| December 2026 | Marking of systems already in service, new prohibitions | Indirectly, through your providers |
| December 2027 | Annex III high-risk systems | Yes if you screen CVs or score customers |
| August 2028 | High-risk AI embedded in regulated products | Rarely, outside regulated industry |
The high-risk delay moves the deadline without removing the obligation. The documentation, human oversight and logging requirements are still written into the text. An SME preparing a CV screening tool for 2027 has a year of margin, and nothing more.
Start with the inventory, because you run more AI than you think
None of the obligations below can be handled without knowing which AI tools circulate inside the company. That is the starting point, and almost nobody has it. The France Num barometer of September 2026, published by the French enterprise directorate, measures that 40 % of micro-businesses and SMEs use at least one AI solution. The share rises to 53 % for SMEs alone, against 26 % a year earlier.
I published this map on LinkedIn in January 2026, in my AI tools map, to show how fragmented the landscape has become by job function. An SME that thinks it uses one tool often runs a dozen, bought by different teams, sometimes on personal cards.
The inventory that compliance asks for is exactly the mapping Tandem runs at the start of every engagement. Which tools, in which department, on which data, for which decision. Our audit method fits in three columns, and it serves use case prioritisation as much as it serves a regulator.
Classify each use case by risk tier
The regulation applies use case by use case. The same model is harmless for summarising a meeting and high risk for choosing between two candidates. Classification therefore happens use case by use case, never tool by tool.
Three common SME use cases deserve close attention, because they move into the high-risk tier in December 2027. Automated CV screening, employee evaluation or promotion, and scoring a customer to grant credit or payment terms. The rest, writing, summarising, translation, internal search and code generation, sit in the minimal risk tier and carry no specific obligation.
Emotion recognition applied to employees in the workplace, however, has been banned since February 2025. A sentiment analysis tool plugged into a contact centre's calls deserves a serious review before going further. The AI use cases for SMEs in an SME are plentiful elsewhere.
What Article 50 has required you to disclose since August 2026
Article 50 of the EU AI Act carries the transparency obligations. This is the part that genuinely applies to an SME today, and it rests on one idea. A person should never find out afterwards that they were talking to a machine or looking at fabricated content.
In detail, telling people that a system is conversing with them falls on the provider of that system. Labelling a deepfake and labelling a published text that informs the public on a matter of public interest both fall on you, the deployer. The European Commission FAQ states that the machine-readable marking added by the vendor is not enough, a visible or audible disclosure is required at first exposure.
In practice, three work items are enough for an SME. An opening line on the website chatbot. A disclosure on synthetic visuals and voices published in communications. A written rule on AI-assisted editorial content, with a named owner.
AI literacy, an obligation of means since February 2025
Article 4 requires providers and deployers to take measures fostering AI literacy among their teams. The July 2026 omnibus rewrote it, and the version in force now states that no specific level has to be guaranteed for any given individual. The duty bears on the measures taken, proportionate to the context of use and to the people concerned.
An SME can therefore answer with very little, provided it writes things down. One dated awareness session, with the attendance list. An internal note saying which tools are approved and on which data. A named contact for questions. Three documents, and the evidence exists.
The trap is to confuse this obligation with a training budget. On our engagements, what truly embeds usage is a ritual rather than a seminar. A session inspires, a ritual installs. Our AI literacy path starts there, and it serves compliance as a side effect rather than the other way round.
Fines, and why the cap reads backwards for an SME
The regulation sets three levels of penalty. Up to 35 million euros or 7 % of worldwide annual turnover for a prohibited practice. Up to 15 million euros or 3 % for deployer obligations and transparency. Up to 7.5 million euros or 1 % for incorrect information supplied to an authority.
For an SME, and since the omnibus for small mid-caps too, the amount applied is the lower of the two. A large company faces the higher one. The gap is considerable and it is rarely explained. Authorities also have to weigh proportionality, company size and cooperation.
Who enforces the EU AI Act in France?
The honest answer, in November 2026, is that the designation is not settled yet. The bill carrying it, the European law adaptation bill, was adopted by the Senate in February 2026 and then sent to the National Assembly, where it awaits examination. France should have notified its authorities to the Commission before August 2025.
The emerging split shares the work out. The consumer protection and fraud control directorate would coordinate and act as the single contact point. The CNIL would take systems touching personal data and biometrics. The audiovisual and digital regulator would follow content transparency, and the prudential supervision authority would cover credit and insurance.
The ten-point EU AI Act checklist for an SME
- List your AI tools, department by department, personal subscriptions included.
- Qualify your role for each one, deployer in almost every case.
- Classify each use case against the four risk tiers, not each tool.
- Check that no prohibited practice applies, especially emotion analysis on employees.
- Disclose AI on your public channels, chatbot, voice agent, synthetic visuals and voices.
- Write your editorial rule on AI-assisted content, with a named owner.
- Date your awareness sessions and keep the list of participants.
- Publish an internal usage note stating what is approved and on which data.
- Keep your providers' instructions and use the tools in line with their intended purpose.
- Spot your future high-risk use cases and set yourself the December 2027 deadline.
These ten points fit in a single document, refreshed twice a year. The difficulty is organisational rather than regulatory, and it meets the question of who decides what on AI inside the company.
Should an SME get EU AI Act compliant right now?
Yes, and the work is lighter than its reputation suggests. For a deploying SME, compliance rests on one inventory, three transparency disclosures and two internal notes. Allow half a day for the first version, then a few hours every six months.
The real benefit sits elsewhere. Across around a hundred engagements, the usage inventory always surfaces the same things. Duplicate subscriptions, sensitive data flowing through unapproved tools, and two or three high-impact use cases nobody had spotted. Compliance pays for itself in visibility, before risk even enters the conversation.
What cannot wait is preparing the use cases that will move into the high-risk tier in December 2027. CV screening, employee evaluation, customer scoring. If one of those projects is on your desk, an AI audit is the moment to set the guardrails, while the system is still out of production.
